Swimlane Turbine Enhances AI Security with Custom Detections and AI SOC Integration
Swimlane Turbine now allows security teams to run custom detection logic against large data volumes, feeding alerts into its AI SOC for automated investigation and response.
Swimlane has significantly expanded the capabilities of its Turbine platform, empowering security teams to develop and deploy their own custom detection logic against vast datasets. This new functionality allows organizations to feed alerts generated by these bespoke detections directly into the Swimlane AI SOC for automated investigation and response. The latest release also introduces two-way Model Context Protocol (MCP) support and a novel Hero AI agent designed to build applications using natural language prompts, thereby enhancing tool integration and workflow automation within security operations.
The evolving landscape of enterprise security, marked by the widespread adoption of agents, MCP servers, copilots, and local AI models, introduces new risks that traditional detection products may not adequately address. Issues such as prompt injection, unsanctioned AI usage, compromised guardrails, and other AI-specific threats can easily bypass vendor-defined detections, leaving AI Security Operations Centers (SOCs) without alerts to investigate. Swimlane's latest advancements directly tackle these Artificial Intelligence Detection and Response (AIDR) use cases, particularly where AI systems themselves are the target of an incident, providing teams with the ability to implement dynamic detection logic when commercial coverage is insufficient.
"The security industry has spent the last two years debating how autonomously AI can work an alert, but that skips a more basic question: where did the alert come from?" stated Cody Cornell, CEO of Swimlane. "As AI introduces new risks faster, investigation depth and quality are going to become essential, vendor-defined detections alone don’t paint the full picture, the teams closest to those environments need a way to define what matters to them. Turbine gives them that control, then connects the resulting alert directly to investigation and response."
The new big data processing capabilities within Swimlane Turbine are designed to bridge the gap between emerging threats and existing detection mechanisms. By enabling security teams to run their own detection logic across large volumes of data, the platform ensures that even highly specific or novel risks can generate alerts. A single big data action can evaluate tens of thousands of records across parallel compute nodes, making customer-defined detection practical at an enterprise scale and driving deeper investigation.
These enhanced detection capabilities extend Turbine's utility further into the detection-to-response lifecycle without necessitating the replacement of existing security tools. While Swimlane continues to ingest alerts from established technologies like SIEM, EDR, and cloud security solutions, it now offers an additional pathway for custom detection logic to feed into the AI SOC. This allows for agentic investigation and governed response, ensuring that organization-specific threats are addressed promptly and effectively.
Key new capabilities and use cases include: customer-defined detection logic for organization-specific threats; AI security use cases addressing risks like local AI model misuse, prompt injection, and bypassed guardrails; AI-assisted detection authoring to help build detections based on natural language descriptions; and enterprise-scale processing for evaluating large datasets efficiently.
Furthermore, the October release significantly expands Model Context Protocol (MCP) support within Turbine, establishing a two-way connection for enhanced security automation. Turbine can now act as an MCP host, allowing Hero AI to directly connect to third-party MCP servers and utilize their tools during investigations, all under centralized control. Conversely, Turbine can function as an MCP server, enabling external AI agents and assistants like ChatGPT and Microsoft Copilot to invoke governed Turbine components and multi-step playbooks within existing role-based access controls. This integration allows for seamless combination of MCP tools and APIs, connecting Swimlane's broad integration capabilities with external MCP-compatible tools and workflows.
Adding to the platform's versatility, the release introduces a new Hero AI Agent specifically for application building. This agent dramatically reduces the manual effort required to create and adapt record structures, layouts, and workflows for new security use cases. Users can now describe the desired application, and Hero AI will assist in its construction, with AI-generated edits remaining unsaved until reviewed and approved by a human, ensuring controlled and effective customization.